Claude connector

MergeHarbor is a remote MCP server at https://app.mergeharbor.com/mcp. Add it to Claude as a connector and Claude can read your pull request reviews, findings, change risk, merge gate, team rules and generated codebase docs, and act on them for you. It signs in as you, so it sees and changes only what you can in the console.

For Claude Code, use the plugin instead.

What you can ask

• “What did MergeHarbor find on acme/api pull request 412? Explain the critical ones.”
• “Is pull request 412 ready to merge? What still blocks it?”
• “How risky is the feat/limits branch in acme/api, and why?”
• “Which findings on my open pull requests are still open, most severe first?”
• “How does checkout work in acme/web? Use the knowledge base.”
• “Has anything in internal/billing been reverted or caused an incident before?”
• “What are our team’s review rules for the api repository?”
• “Estimate a Shipyard task to add rate limiting to the export endpoint in acme/api.”

Connect

1. In Claude, open Customize → Connectors and choose Add custom connector. Or find MergeHarbor in Claude’s connector directory.
2. Enter the URL https://app.mergeharbor.com/mcp. On a self-hosted installation, use https://<your MergeHarbor address>/mcp.
3. Select Connect. Your browser opens MergeHarbor’s consent page. Sign in to the console if you aren’t already.
4. Choose the organization and select Allow. Your browser returns to Claude.

Connectors you add on the web also work in Claude’s desktop and mobile apps.

Sign-in and permissions

Claude signs in with OAuth 2.1 and PKCE. There is nothing to copy and no API key to store.

• You approve it once, for one organization. The consent page names the app that is asking, shows where your browser will return, and asks you to pick one organization. To switch organizations, disconnect and connect again.
• It acts as you. Every tool call runs with your role’s permissions and your repository access in that organization. A tool you lack the permission for returns an error. Your organization’s single sign-on, IP allow list and session lifetime rules still apply.
• Tokens are short-lived. Access tokens last one hour and Claude refreshes them on its own. Each refresh replaces the refresh token. A connection that is not used for 30 days must sign in again. MergeHarbor stores only hashes of tokens.
• Administrators keep control. Removing someone from the organization, or a change to their single sign-on or session policy, ends their connections at once. Proposed rules apply only after an administrator approves them, and Shipyard follows your organization’s Shipyard limits and approval settings.

Claude identifies itself with a client ID metadata document: an https:// address that MergeHarbor fetches to learn the app’s name and the addresses it may return to. The consent page and your list of signed-in agents show that name with the document’s domain.

Tools

Reading tools return data MergeHarbor already has. Tools that change something are marked so in their annotations, so Claude asks before it uses them.

Tool	Title	What it does	Reads or changes
list_findings	List review findings	Findings in the organization, most severe first, by repository, pull request, status and severity	Reads
get_finding	Get a finding	One finding with its explanation, suggested change and the commit to read code at	Reads
list_unaddressed	List findings left to fix	Open findings on a pull request, found from the pull request number or the branch name	Reads
fix_all_plan	Plan fixes for a pull request	Every open finding of a pull request in one plan, grouped by file, most severe first	Reads
apply_fix	Get a patch for a finding	A patch for a finding’s suggested change. Writes nothing	Reads
get_pr_review	Get a pull request review	The latest review of a pull request: score, summary and findings	Reads
get_change_risk	Get a pull request’s change risk	The change risk score, level and the factors behind it	Reads
get_merge_gate	Get a pull request’s merge gate	The merge gate verdict, readiness score and the checklist of what blocks or warns	Reads
list_rules	List team rules	The review rules MergeHarbor applies, organization-wide and per repository	Reads
list_knowledge_bases	List knowledge bases	Repositories with a generated knowledge base, with status and page counts	Reads
get_knowledge_page	Read a knowledge base page	A repository’s knowledge base index, or one page: a module, a flow, conventions, recipes, or past reverts	Reads
search_knowledge_base	Search knowledge bases	Full-text search across knowledge base pages	Reads
get_change_history	Reverts and incidents	Past reverts, rollbacks, hotfixes and incident fixes in a repository, optionally for given files	Reads
shipyard_estimate	Estimate a Shipyard coding task	What a Shipyard task would cost in credits, its limits, and whether it may start. No credits	Reads
shipyard_get	Get a Shipyard coding task	A task’s status, plan, credits used, checks, changed files and pull request	Reads
shipyard_events	List a Shipyard task’s events	A task’s progress log, oldest first	Reads
resolve_finding	Resolve a finding	Marks a finding addressed, dismisses it with a reason, or reopens it	Changes
mark_addressed	Mark findings addressed	Marks up to 100 findings you fixed as addressed	Changes
add_rule	Propose a team rule	Proposes a review rule. It applies only after an administrator approves it	Changes
shipyard_start	Start a Shipyard coding task	Starts a coding task that plans the change, makes it on a new branch and opens a pull request	Changes

The server also offers each pull request’s latest review and each repository’s knowledge base as resources, and a fix_finding prompt.

Shipyard tools

The Shipyard tools need the Shipyard add-on. Starting a task also needs permission to fix pull requests in the repository.

• shipyard_estimate makes no model calls and uses no credits. Claude is told to estimate first and confirm the cost with you.
• shipyard_start uses credits, up to the task’s cap and within your organization’s per-task, concurrency and monthly limits.
• shipyard_start never approves a plan. The plan waits for approval in the console unless your organization’s Shipyard settings approve it automatically. Only after approval does Shipyard push a new branch and open a pull request.

The other tools use no credits.

Data handling

• What MergeHarbor receives. The arguments Claude sends to each tool, such as repository names, pull request numbers, finding IDs, search terms, a file’s contents when it asks for a patch fitted to your copy, and a Shipyard task’s instructions. MergeHarbor does not receive your conversation with Claude.
• What Claude receives. What each tool returns, such as findings, reviews, rules and knowledge base pages, becomes part of your conversation with Claude.
• What MergeHarbor records. The name the app signs in with, when it signed in and was last used, and the IP address of each request, used to apply IP allow lists. Changes made through the connector appear in your organization’s audit log like other changes.
• AI models. Only Shipyard tasks run models, as described in How MergeHarbor uses AI and your code.

See the privacy policy, section 5, for the full terms.

Disconnect

• From MergeHarbor. Open the account menu, choose Your coding agent, find Claude under Signed-in coding agents and select Sign out. Its access stops right away.
• From Claude. Remove or disconnect the connector under Customize → Connectors. Sign it out in MergeHarbor as well to end the session there.

Rate limits

Requests are limited per connection. If Claude sends too many at once, MergeHarbor answers 429 with rate_limited and a Retry-After header, and the request succeeds after a short wait.

Troubleshooting

What you see	What to do
“Unknown client or redirect URI. Remove the MergeHarbor server from your agent and add it again.”	Remove the connector in Claude and add it again.
“This sign-in has expired”	Sign-in requests last 10 minutes and work once. Select Connect in Claude again.
“No organization to connect”	You aren’t a member of any MergeHarbor organization. Ask an administrator to invite you, then connect again.
“The access token is invalid, expired or revoked; sign in again.”	The connection was signed out or unused for 30 days. Disconnect and connect again.
“Your access to this organization changed (membership, single sign-on or session policy)”	Your membership or your organization’s sign-in rules changed. Sign in to the console, then connect again.
A tool says your role lacks a permission	Your role can’t do that in this organization. Ask an administrator for the permission.
A repository is “not found”	Check the owner/name. You may not have access to that repository, or, for Shipyard, permission to start tasks in it.
A Shipyard tool says the add-on is needed	A billing admin can add Shipyard or start a trial under Billing → Plan.
“The merge gate does not apply to this pull request”	The repository isn’t enabled for the merge gate, the policy is off, or the pull request is closed.
429 rate_limited	Wait for the seconds in Retry-After and try again.